PT-2026-67489 · Npm · Socket.Io

CVE-2026-69185 · Published 2026-08-03 · Updated 2026-08-03

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Socket.IO versions prior to 4.2.7 Socket.IO versions prior to 3.4.5 Socket.IO versions prior to 3.3.6

Description A specially crafted Socket.IO packet can force the server to wait for and buffer an excessive number of binary attachments. This behavior can be exploited to exhaust the server's memory resources, leading to a denial of service.

Recommendations Update to version 4.2.7 or later. Update to version 3.4.5 or later. Update to version 3.3.6 or later.

Exploit

Fix

Improper Check for Exceptional Conditions

RCE

Weakness Enumeration

CWE-754

CWE-20

Related Identifiers

CVE-2026-69185

GHSA-2M8V-J782-FHVR

Affected Products

Socket.Io

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/69xxx/CVE-2026-69185.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-69185 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2m8v-j782-fhvr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-69185 · Security Note
• https://github.com/socketio/socket.io/commit/9c6323e5cde41bd75df3379b5fc9293664a5f240 · Note
• https://github.com/socketio/socket.io/commit/7c6ef571a00656718e9e05e3b948fd1758b2a7b4 · Note
• https://github.com/socketio/socket.io/security/advisories/GHSA-2m8v-j782-fhvr · Note
• https://github.com/socketio/socket.io/commit/ced94ffa3ac020a8f3c14eb98a3bf34acb14d291 · Note
• https://github.com/socketio/socket.io · Note